Use shared Redis for email-change verification

[jmgasper]

Email-change verification fails when the request reaches a different API instance from the one that issued the link. The old cache configuration uses store, which @nestjs/cache-manager 3 ignores, so pending changes stay in each instance's memory despite Redis being configured.

Configure the global cache through a Redis-backed Keyv stores entry. Keep millisecond TTLs, isolate keys under the identity-api-v6 namespace, and reject failed writes. Add integration coverage for a flow that crosses instances and completes after the issuing instance stops, plus replay rejection, expiration, deletion, and write failures. Document the shared-cache requirement and the active email-template configuration.

Validation:

• pnpm lint and pnpm build pass.
• All 10 focused cache and email-change tests pass against isolated Redis with mocked email delivery and account updates.
• The built container passed shared-state, expiry, and deletion checks against production Redis in a temporary ECS task, using only synthetic keys.
• The full suite has the same 66 failing tests as production base 42bccf0; this change introduces no new failures.

Pending email-change requests issued by the old in-memory cache must be restarted after rollout.

Production rollout completed on ECS task definition identity-api-v6:25, image tag redis-cache-cf9ef84. All four API instances are healthy; the post-rollout check found no Redis cache read/write errors.